Skip to main content

Vulnerabilities Hub

Path: /vulnerabilities · Sidebar: Findings → Vulnerabilities

This is the central place where issues from every source - DAST, SAST, SCA, containers, IaC, secrets and imports - converge as unified, deduplicated Vulnerabilities and where you triage them.

Cross-tool deduplication​

apPosture computes a source-aware fingerprint for each finding and merges those that describe the same real issue into one vulnerability. So if SAST and DAST both flag the same SQL injection, you see one entry carrying both pieces of evidence - not two tickets.

The list​

A flat, sortable column table - Risk · Severity · Finding · Location · Age · Status - with a shared width contract and sortable headers (Risk, Severity, Finding, Age). The Finding column carries inline signal chips (KEV, exploitable, reachable, SLA-breached). Above it sits a single toolbar:

  • All / Signal toggle - flip to Signal to see only what matters: proven-exploitable, internet-reachable, KEV, SLA-breached, or risk ≥ 60. The view is shareable via a ?sig=1 URL.
  • Search and Group by - group by None (flat, the default), Application, Target, OWASP, Severity or Project.
  • Filters - a popover behind a Filters button (with an active-count badge): severity, status, source, application, KEV, reachability, exploit status, and date - including new within N days and past SLA. The panel states its own result count, and a filtered deep link round-trips exactly.
  • CSV export that matches the list it came from - the same filters, sort and group.

The list is server-driven: filtering, sorting, grouping and paging all resolve in the database, so it stays fast on a large estate (the pager shows the true in-range total). Sorting by Risk puts the highest-priority, proof-weighted issues at the top.

Bulk actions​

Select rows - or select everything a filter matches, across pages - and apply a status change, owner, false-positive or risk-acceptance in one action. Group rows scope the selection to just that group.

Triage workflow​

Open a vulnerability and move it through its lifecycle:

New → Triaged → Confirmed → In progress → Resolved → Verified → Closed
                   └── False positive
                   └── Risk accepted

For each vulnerability you can:

  1. Set status and assign an owner.
  2. Mark false positive - suppresses it and teaches future scans (see Mutes).
  3. Accept risk - record a justified exception with an expiry.
  4. Create a ticket / notify the owner.
  5. Review the SLA deadline derived from severity.

Vulnerability detail​

Path: /vulnerabilities/[id]

The detail page shows:

  • Merged evidence from every contributing source/finding.
  • Proof-of-exploit when exploitability was proven (the strongest priority signal).
  • CWE/OWASP mapping, CVSS, EPSS, KEV flag, reachability.
  • Remediation guidance and references.
  • History - status changes and correlation across assessments.
Triage by truth, not volume

Sort by exploit confirmed and KEV first. A proven-exploitable issue outranks a pile of theoretical highs. The Priorities page automates exactly this ranking.

Last updated on